# Pie with all source files **URL:** \ **Category:** Kibana\ **Created:** [February 20, 2018, 2:33pm UTC](https://discuss.elastic.co/t/pie-with-all-source-files/120664 "2018-02-20T14:33:18Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![flochon](https://avatars.discourse-cdn.com/v4/letter/f/e19b73/32.png) [@flochon](https://discuss.elastic.co/u/flochon)\ **Post date:** [February 20, 2018, 2:33pm UTC](https://discuss.elastic.co/t/pie-with-all-source-files/120664/1 "2018-02-20T14:33:18Z")
How to create a pie with all source files where my logs come ? ---
**Author:** ![ppisljar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ppisljar/32/11588_2.png) [@ppisljar](https://discuss.elastic.co/u/ppisljar)\ **Post date:** [February 20, 2018, 2:40pm UTC](https://discuss.elastic.co/t/pie-with-all-source-files/120664/2 "2018-02-20T14:40:42Z")
could you provide some more details please ? in general, - click visualize - select pie chart - select your index pattern - in the editor on the left click `Split Slices` - select `Terms Aggregation` - in the field selector choose a field where your filename is indexed - click Apply (the green play button at the top of the editor) ---
**Author:** ![flochon](https://avatars.discourse-cdn.com/v4/letter/f/e19b73/32.png) [@flochon](https://discuss.elastic.co/u/flochon)\ **Post date:** [February 20, 2018, 2:45pm UTC](https://discuss.elastic.co/t/pie-with-all-source-files/120664/3 "2018-02-20T14:45:40Z")
I make all th steps but in final I don't have all my source files. I have 10 source files and I see just these ones ![Sans%20titre](https://us1.discourse-cdn.com/elastic/original/3X/e/2/e215581f152e94802131b030951a95d77d4161c1.png) I don't understand why aren't all source files visible. ---
**Author:** ![ppisljar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ppisljar/32/11588_2.png) [@ppisljar](https://discuss.elastic.co/u/ppisljar)\ **Post date:** [February 20, 2018, 2:47pm UTC](https://discuss.elastic.co/t/pie-with-all-source-files/120664/4 "2018-02-20T14:47:04Z")
in the term aggregation configuration (editor on the left) change size from 5 to larger number, like 50. ---
**Author:** ![flochon](https://avatars.discourse-cdn.com/v4/letter/f/e19b73/32.png) [@flochon](https://discuss.elastic.co/u/flochon)\ **Post date:** [February 20, 2018, 2:49pm UTC](https://discuss.elastic.co/t/pie-with-all-source-files/120664/5 "2018-02-20T14:49:15Z")
Yes, yes I make that but nothing changed. ![Sans%20titre](https://us1.discourse-cdn.com/elastic/original/3X/e/6/e6ebbc79d409ab3535d4bef6cc755c23b4df7c96.png) ---
**Author:** ![ppisljar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ppisljar/32/11588_2.png) [@ppisljar](https://discuss.elastic.co/u/ppisljar)\ **Post date:** [February 20, 2018, 2:54pm UTC](https://discuss.elastic.co/t/pie-with-all-source-files/120664/6 "2018-02-20T14:54:14Z")
on the top right there is a time picker. what time range are looking at ? select more data than the last 15 minutes . ---
**Author:** ![flochon](https://avatars.discourse-cdn.com/v4/letter/f/e19b73/32.png) [@flochon](https://discuss.elastic.co/u/flochon)\ **Post date:** [February 20, 2018, 3:04pm UTC](https://discuss.elastic.co/t/pie-with-all-source-files/120664/7 "2018-02-20T15:04:35Z")
I select "This month" and I can see in "Discover" more than 5 sources. For example, I have this source: ![Sans%20titre%202](https://us1.discourse-cdn.com/elastic/original/3X/5/e/5e09d177f905d6f051cbef2b03092605eb7223f5.png) And if I want see my pie as I did earlier ![Sans%20titre%203](https://us1.discourse-cdn.com/elastic/original/3X/6/b/6b8fc98d7a669f6003c44d45471201d0b3f081c9.png) ---
**Author:** ![ppisljar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ppisljar/32/11588_2.png) [@ppisljar](https://discuss.elastic.co/u/ppisljar)\ **Post date:** [February 20, 2018, 3:16pm UTC](https://discuss.elastic.co/t/pie-with-all-source-files/120664/8 "2018-02-20T15:16:34Z")
that does look like a bug. could you open up a spy panel (gray up arrow at the bottom of your chart) and copy-paste elasticsearch request and response. thank you. ---
**Author:** ![flochon](https://avatars.discourse-cdn.com/v4/letter/f/e19b73/32.png) [@flochon](https://discuss.elastic.co/u/flochon)\ **Post date:** [February 20, 2018, 3:24pm UTC](https://discuss.elastic.co/t/pie-with-all-source-files/120664/9 "2018-02-20T15:24:56Z")
Yes of course Request: ```auto { "size": 0, "_source": { "excludes": [] }, "aggs": { "2": { "terms": { "field": "source.keyword", "size": 10, "order": { "_count": "desc" } } } }, "stored_fields": [ "*" ], "script_fields": {}, "docvalue_fields": [ "@timestamp", "received_at" ], "query": { "bool": { "must": [ { "match_all": {} }, { "range": { "@timestamp": { "gte": 1518693498102, "lte": 1518694533445, "format": "epoch_millis" } } } ], "filter": [], "should": [], "must_not": [] } } } ``` Response: ```auto { "took": 7, "timed_out": false, "_shards": { "total": 31, "successful": 31, "skipped": 0, "failed": 0 }, "hits": { "total": 11492, "max_score": 0, "hits": [] }, "aggregations": { "2": { "doc_count_error_upper_bound": 0, "sum_other_doc_count": 0, "buckets": [] } }, "status": 200 } ``` ---
**Author:** ![ppisljar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ppisljar/32/11588_2.png) [@ppisljar](https://discuss.elastic.co/u/ppisljar)\ **Post date:** [February 20, 2018, 3:52pm UTC](https://discuss.elastic.co/t/pie-with-all-source-files/120664/10 "2018-02-20T15:52:08Z")
everything seems ok, elasticsearch can't find any documents with source.keyword field ... however in the discover you do see documents with this field set ... ---
**Author:** ![flochon](https://avatars.discourse-cdn.com/v4/letter/f/e19b73/32.png) [@flochon](https://discuss.elastic.co/u/flochon)\ **Post date:** [February 20, 2018, 3:54pm UTC](https://discuss.elastic.co/t/pie-with-all-source-files/120664/11 "2018-02-20T15:54:03Z")
I don't understand... I think all is right but ... ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 20, 2018, 3:54pm UTC](https://discuss.elastic.co/t/pie-with-all-source-files/120664/12 "2018-03-20T15:54:06Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.